Dear Customer,
We are contacting you because there is an invoice on your account
that is overdue for payment and although we have contacted you already
our system is still showing that the invoice remains unpaid.

RST Support Services LimitedRotary Watches Ltd
2 Fouberts Place
London

If there is any reason why payment should not be made or if you are
experiencing difficulties with making the payment please get in touch so
that we can discuss the matter and stop the recovery process.
Kind regards,
Rebecca HughesCustomer services team PGS Services | Expert Property CareDirect dial: 0203 819 7054Email: rebecca@pgs-services.co.ukVisit our website: www.pgs-services.co.uk10 quick questions - tell us what you think!http://www.pgs-services.co.uk/feedback/

Attached is a file 3-6555-73329-1435806061-3.doc which comes in at least three different versions (VirusTotal results [1][2][3]) and these Malwr reports [4][5][6] indicate that it downloads a malicious binary from the following locations:

3 comments:

Hi,you can not imagine how much I am thankful as I got this email today and I was sooooo confused as the sender email and domain is belong to a real company. As well as, yesterday I got a similar email asking for payment with same convincing information and a real company and real domain (Kidd.uk). The thing is that I've tried to contact the kidd.uk company but an automatic reply told me to send it to another email which made me sure that there is something wrong! as how a company would make their customer service contact replied like that ! and bothe emails contain an attachment that both hotmail and gmail could not viewed it online!

But I've noticed some thing, even that I did not download or open the attachment, when I tried to open some webpages that asking for my login info, the firefox browser denied my access and said that the connection is not safe as there is some one who is trying to hack me or something like that.